ziglang/zig

Fork 773

Code Issues 707 Pull requests 290 Activity Actions 28

Compiler segfault with labeled break and unlabeled break inside `inline for` #35351

New issue

Open

opened 2026年05月19日 05:05:52 +02:00 by violeshnv · 3 comments

violeshnv commented

2026年05月19日 05:05:52 +02:00

Copy link

Zig Version

0.17.0-dev.305+bdfbf432d

Steps to Reproduce and Observed Behavior

fnfoo()void{for(0..10)|i|{inlinefor(.{1,2,3})|_|{mock_continue:{if(i<5)break:mock_continue;break;}}}}pubfnmain()!void{foo();}

if (i < 5)
break :mock_continue
unlabeled break inside inline for

are necessary to reproduce segmentation fault.

Expected Behavior

compilation success or semantic error instead of raw segfault.

### Zig Version 0.17.0-dev.305+bdfbf432d ### Steps to Reproduce and Observed Behavior ```zig fn foo() void { for (0..10) |i| { inline for (.{ 1, 2, 3 }) |_| { mock_continue: { if (i < 5) break :mock_continue; break; } } } } pub fn main() !void { foo(); } ``` - `if (i < 5)` - `break :mock_continue` - unlabeled `break` inside `inline for` are necessary to reproduce segmentation fault. ### Expected Behavior compilation success or semantic error instead of raw segfault.

👍 1

violeshnv added the

bug

label

2026年05月19日 05:05:52 +02:00

violeshnv commented

2026年05月19日 05:42:47 +02:00

Author

Copy link

The workaround is never using an unlabeled break inside inline for.

fnfoo()void{for(0..10)|i|{mock_break:{inlinefor(.{1,2,3})|_|mock_continue:{if(i<5)break:mock_continue;break:mock_break;}}}}

The workaround is never using an unlabeled break inside inline for. ```zig fn foo() void { for (0..10) |i| { mock_break: { inline for (.{ 1, 2, 3 }) |_| mock_continue: { if (i < 5) break :mock_continue; break :mock_break; } } } } ```

by965738071 commented

2026年05月19日 09:46:35 +02:00

Copy link

break :mock_break exits the entire mock_break block directly, thereby also exiting the inline for loop. However, if the break is executed in any one of the three copies generated by the inline for loop, it is equivalent to inserting a non-local jump into the code expanded at compile time.
The runtime condition i >= 5 makes the execution of the break dependent on the loop variable i, yet the expansion of the inline for loop is completed at compile time. After compile-time expansion, the break instruction in each copy must correspond to a valid jump target. The Zig compiler may still generate a segmentation fault when handling such "runtime breaks out of compile-time expanded loops".

break :mock_break exits the entire mock_break block directly, thereby also exiting the inline for loop. However, if the break is executed in any one of the three copies generated by the inline for loop, it is equivalent to inserting a non-local jump into the code expanded at compile time. The runtime condition i >= 5 makes the execution of the break dependent on the loop variable i, yet the expansion of the inline for loop is completed at compile time. After compile-time expansion, the break instruction in each copy must correspond to a valid jump target. The Zig compiler may still generate a segmentation fault when handling such "runtime breaks out of compile-time expanded loops".

alexrp commented

2026年05月22日 19:56:45 +02:00

Owner

Copy link

thread 60704 panic: attempt to use null value
/home/alexrp/Sources/ziglang/zig/lib/std/debug.zig:1836:10: 0x2114eb7 in resolveLoopLiveSet (zig)
 l.state = .unlocked;
 ^oo
/home/alexrp/Sources/ziglang/zig/src/Air/Liveness.zig:1154:35: 0x2110d58 in analyzeInstLoop__anon_1764192 (zig)
 try resolveLoopLiveSet(a, data, inst);
 ^
/home/alexrp/Sources/ziglang/zig/src/Air/Liveness.zig:996:28: 0x211417b in analyzeInstBlock__anon_1764110 (zig)
 try analyzeBody(a, pass, data, body);
 ^
/home/alexrp/Sources/ziglang/zig/src/Air/Liveness.zig:750:44: 0x2111462 in analyzeInst__anon_1763996 (zig)
 const block = a.air.unwrapBlock(inst);
 ^
/home/alexrp/Sources/ziglang/zig/src/Air/Liveness.zig:179:24: 0x1e7a12f in analyze (zig)
 try analyzeBody(&a, .main_analysis, &data, main_body);
 ^
/home/alexrp/Sources/ziglang/zig/src/Zcu.zig:5374:29: 0x21429d5 in workerCodegenOwnedAir (zig)
 return pt.runCodegen(func_index, &air);
 ^
/home/alexrp/Sources/ziglang/zig/lib/std/Io/Threaded.zig:741:20: 0x156d086 in start (zig)
 future.func(future.contextPointer(), future.resultPointer());
 ^
/home/alexrp/Sources/ziglang/zig/lib/std/Io/Threaded.zig:1797:29: 0x156bc06 in worker (zig)
 runnable.startFn(runnable, &thread, t);
 ^
./nptl/pthread_create.c:448:8: 0x7695a52a3d63 in start_thread (pthread_create.c)
../sysdeps/unix/sysv/linux/x86_64/clone3.S:78: 0x7695a53373fb in __GI___clone3 (../sysdeps/unix/sysv/linux/x86_64/clone3.S)

``` thread 60704 panic: attempt to use null value /home/alexrp/Sources/ziglang/zig/lib/std/debug.zig:1836:10: 0x2114eb7 in resolveLoopLiveSet (zig) l.state = .unlocked; ^oo /home/alexrp/Sources/ziglang/zig/src/Air/Liveness.zig:1154:35: 0x2110d58 in analyzeInstLoop__anon_1764192 (zig) try resolveLoopLiveSet(a, data, inst); ^ /home/alexrp/Sources/ziglang/zig/src/Air/Liveness.zig:996:28: 0x211417b in analyzeInstBlock__anon_1764110 (zig) try analyzeBody(a, pass, data, body); ^ /home/alexrp/Sources/ziglang/zig/src/Air/Liveness.zig:750:44: 0x2111462 in analyzeInst__anon_1763996 (zig) const block = a.air.unwrapBlock(inst); ^ /home/alexrp/Sources/ziglang/zig/src/Air/Liveness.zig:179:24: 0x1e7a12f in analyze (zig) try analyzeBody(&a, .main_analysis, &data, main_body); ^ /home/alexrp/Sources/ziglang/zig/src/Zcu.zig:5374:29: 0x21429d5 in workerCodegenOwnedAir (zig) return pt.runCodegen(func_index, &air); ^ /home/alexrp/Sources/ziglang/zig/lib/std/Io/Threaded.zig:741:20: 0x156d086 in start (zig) future.func(future.contextPointer(), future.resultPointer()); ^ /home/alexrp/Sources/ziglang/zig/lib/std/Io/Threaded.zig:1797:29: 0x156bc06 in worker (zig) runnable.startFn(runnable, &thread, t); ^ ./nptl/pthread_create.c:448:8: 0x7695a52a3d63 in start_thread (pthread_create.c) ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78: 0x7695a53373fb in __GI___clone3 (../sysdeps/unix/sysv/linux/x86_64/clone3.S) ```

alexrp added the

frontend

label

2026年05月22日 19:57:03 +02:00

No Branch/Tag specified

Branches Tags

master

elfv2

spork8

restricted

0.16.x

panic-rewrite

parking-futex-lockfree

windows-Io-cleanup

Io-watch

ParseCommandLineOptions

windows-async-files

poll-ring

debug-file-leaks-differently

debug-file-leaks

ProcessPrng

elfv2-dyn

jobserver

threadtheft

io-threaded-no-queue

0.15.x

Io.net

comptime-allocator

restricted-function-pointers

cli

wasm-linker-writer

wrangle-writer-buffering

sha1-stream

async-await-demo

fixes

0.14.x

ast-node-methods

macos-debug-info

make-vs-configure

fuzz-macos

sans-aro

ArrayList-reserve

incr-bug

llvm-ir-nosanitize-metadata

ci-tarballs

ci-scripts

threadpool

0.12.x

new-pkg-hash

json-diagnostics

more-doctests

rework-comptime-mutation

0.11.x

ci-perf-comment

stage2-async

0.10.x

autofix

0.9.x

aro

hcs

0.8.x

0.7.x

Labels

Clear labels

This proposal is planned.

The web application for interactive documentation and generation of its assets.

backend/c

The C backend outputs C source code.

backend/llvm

The LLVM backend outputs an LLVM bitcode module.

backend/self-hosted

The self-hosted backends produce machine code directly.

binutils

Zig's included binary utilities: zig ar, zig dlltool, zig lib, zig ranlib, zig objcopy, and zig rc.

breaking

Implementing this issue could cause existing code to no longer compile or have different behavior.

build system

The Zig build system - zig build, std.Build, the build runner, and package management.

debug info

docs

An issue with documentation, e.g. the language reference or standard library doc comments.

error message

This issue points out an error message that is unhelpful and should be improved.

frontend

Tokenization, parsing, AstGen, ZonGen, Sema, Legalize, and Liveness.

fuzzing

incremental

Reuse of internal compiler state for faster compilation.

lib/c

This issue relates to Zig's libc implementation and/or vendored libcs.

lib/compiler-rt

This issue relates to Zig's compiler-rt library.

lib/cxx

This issue relates to Zig's vendored libc++ and/or libc++abi.

lib/std

This issue relates to Zig's standard library.

lib/tsan

This issue relates to Zig's vendored libtsan.

lib/ubsan-rt

This issue relates to Zig's ubsan-rt library.

lib/unwind

This issue relates to Zig's vendored libunwind.

linking

Zig's integrated object file and incremental linker.

miscompilation

The compiler reports success but produces semantically incorrect code.

This issue suggests language modifications. If it also has the "accepted" label then it is planned.

release notes

This issue or pull request should be mentioned in the release notes.

testing

This issue is related to testing the compiler, standard library, or other parts of Zig.

zig cc

Zig as a drop-in C-family compiler.

zig fmt

The Zig source code formatter.

zig reduce

The Zig source code reduction tool.

bounty

https://ziglang.org/news/announcing-donor-bounties

bug

Observed behavior contradicts documented or intended behavior.

contributor-friendly

This issue is limited in scope and/or knowledge of project internals.

downstream

An issue with a third-party project that uses this project.

enhancement

Solving this issue will likely involve adding new logic or components to the codebase.

infra

optimization

A task to improve performance and/or resource usage.

question

No questions on the issue tracker; use a community space instead.

regression

Something that used to work in a previous version stopped working

upstream

An issue with a third-party project that this project uses.

use case

Describes a real use case that is difficult or impossible, but does not propose a solution.

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

3 participants

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

ziglang/zig#35351

No description provided.

Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?

Compiler segfault with labeled break and unlabeled break inside inline for #35351

Zig Version

Steps to Reproduce and Observed Behavior

Expected Behavior

Compiler segfault with labeled break and unlabeled break inside `inline for` #35351